Export all search results to a file
sumo_export_resultsExport Sumo Logic search results directly to an NDJSON file on disk for bulk analysis. Returns the file path instead of inline content, handling up to 100,000 messages per export.
Instructions
Runs a search and streams ALL results (up to the 100,000 server cap) to an NDJSON file on disk, returning the file path — NOT the content. Use this for bulk analysis ("feed the logs to a coding agent") instead of large inline limits. Each line is one flattened log object (metadata + parsed _raw log.* fields). Lines are CHRONOLOGICAL (oldest→newest by _messagetime; the server appends "| sort by _messagetime asc" to non-aggregate queries — a PARTIAL result may not be fully ordered). Aggregate queries export their records instead (one JSON record per line, query order; maxMessages/extract do not apply). If more than 100k messages match, split the time range into multiple exports. Time range: exactly ONE of last (relative, e.g. "15m", "2h"; units s/m/h/d) OR both from and to (ISO-8601 like 2026-07-02T18:28:00, or epoch milliseconds).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time: ISO-8601 or epoch ms. Requires `from`. | |
| from | No | Start time: ISO-8601 or epoch ms. Requires `to`. | |
| last | No | Relative window ending now, e.g. "15m", "2h", "1d". Mutually exclusive with from/to. | |
| query | Yes | Sumo Logic query text. | |
| extract | No | Optional per-field JSON extraction: alias → path under _raw, e.g. {"status":"log.status","user":"log.context.user"}. Appends one `| json field=_raw "<path>" as <alias> nodrop` clause per entry (chained; never the broken comma multi-extract form). Aliases must be simple identifiers; non-aggregate queries only. Extracted aliases join the flattened field namespace (combine with `fields` or ndjson/export lines). | |
| timeZone | No | IANA timezone for query-time parsing (default UTC). | |
| maxMessages | No | Stop after this many messages (default 100,000). | |
| byReceiptTime | No | Search by receipt time; recommended true for very recent windows (ingestion lag). |